CVE-2026-49174

CVE-2026-49174 describes a vulnerability in Microsoft Windows DNS where missing authentication for a critical function could allow a locally authorized attacker to tamper with DNS behavior. The NVD entry notes a CVSS v3.1 base score of 6.1 (Medium) with a LOCAL attack vector, LOW attack complexit...

CVE-2026-9127

A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the...

.NET Tampering Vulnerability

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to perform tampering locally...

Windows DNS Client Tampering Vulnerability

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability

Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally...

DNS Client Tampering Vulnerability

Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

DNS Client Tampering Vulnerability

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability

Time-of-check time-of-use toctou race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally...

Outlook Copilot Tampering Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Outlook Copilot allows an authorized attacker to perform tampering over a network...

Windows Server Update Service (WSUS) Tampering Vulnerability

Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network...

EUVD-2026-43611

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-58149

Name of the Vulnerable Software and Affected Versions Microsoft Windows DNS affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to perform local tampering, which can affect the system. Recommendations At the moment, there is no...

PT-2026-58715

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description Improper link resolution before file access, also known as link following, allows an authorized attacker to perform local tampering. This occurs when the system does not properly validate symbol...

KLA91143 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

Microsoft Windows Subsystem for Linux (WSL2) < 2.7.10 Tampering (CVE-2026-57973) (July 2026)

The version of Microsoft Windows Subsystem for Linux WSL2 on the remote Windows host is prior to 2.7.10. It is, therefore, affected by a tampering vulnerability: - Time-of-check time-of-use toctou race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering...

PT-2026-58469

Name of the Vulnerable Software and Affected Versions Microsoft Windows DNS affected versions not specified Description Improper access control in the Windows DNS Client allows an authorized, logged-in attacker to perform local tampering. Recommendations At the moment, there is no information abo...

PT-2026-58637

Name of the Vulnerable Software and Affected Versions Windows Subsystem for Linux versions prior to 2.7.10 Description A time-of-check time-of-use TOCTOU race condition exists in the Windows Subsystem for Linux. This flaw allows an authorized local attacker to perform data tampering. A TOCTOU rac...

PT-2026-58746

Name of the Vulnerable Software and Affected Versions NVIDIA TensorRT-LLM for Linux affected versions not specified Description A flaw exists in the restricted unpickler used for model weight deserialization. This allows a local, unauthenticated attacker to trigger the deserialization of untruste...

UBUNTU-CVE-2026-50526

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to perform tampering locally...

CVE-2026-56877

The SCORM lab launch endpoint in Skillable scorm.skillable.com through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consum...